It also happens with the following process:

1. create a new 20 char password
2. system truncates your input to 16 chars
3. try to log in with your 20 char password, fail since it doesn’t match the hash for the 16 char version of it
4. go to 1 (or follow the op image if you use the same pass)